Bug

The vulnerability, tracked as CVE-2023-29336, is rated 7.8 for severity and concerns an elevation of privilege bug in the Win32k component.

"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," Microsoft disclosed in an advisory issued last month as part of Patch Tuesday updates.

Részletek itt.

Linux IPv6 "Route of Death" 0day

Max VA @maxpl0it published an article describing remote DoS vulnerability in the code handling IPv6 routing headershttps://t.co/7Me5zrw5Y2

— Linux Kernel Security (@linkersec) May 25, 2023

If the amount of space we're adding to the start of the buffer is more than we have allocated, then it'll cause a kernel panic instead of continuing execution. This means that any vulnerabilities that would ordinarily cause out-of-bounds behaviour (the good stuff) are now reduced to denial-of-service bugs.

While a denial-of-service bug may seem boring, the "remote" aspect usually associated with sk_buffs make them still pretty interesting. A remote kernel panic is still pretty fun!

Részletek itt.

Egyes Pixel 6 és Pixel 6a telefonok is érintettek lehetnek.

PoC:

Hilarious, a Windows 98 user found a real OpenSSH remote ? https://t.co/MKqlbhrn09

— Tavis Ormandy (@taviso) February 3, 2023

Egy Windows 98 user véletlenül fogott egy OpenSSH bugot. Megihlette a felfedezés a biztonsági szakembereket és nekiálltak exploito(ka)t fejleszteni rá:

#XOrg Server Hit By New Local Privilege Escalation Vulnerabilityhttps://t.co/IXw6rn6NhZ

— Phoronix (@phoronix) February 7, 2023

This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

Részletek itt.

Demonstrating CVE-2022-37958 RCE Vuln. Reachable via any Windows application protocol that authenticates. Yes, that means RDP, SMB and many more. Please patch this one, it's serious! https://t.co/ikOrTvQIJs pic.twitter.com/bOTmL5Fh2H

— chompie (@chompie1337) December 13, 2022

The vulnerability could allow attackers to remotely execute arbitrary code by accessing the NEGOEX protocol via any Windows application protocol that authenticates, such as Server Message Block (SMB) or Remote Desktop Protocol (RDP), by default. This list of affected protocols is not complete and may exist wherever SPNEGO is in use, including in Simple Message Transport Protocol (SMTP) and Hyper Text Transfer Protocol (HTTP) when SPNEGO authentication negotiation is enabled, such as for use with Kerberos or Net-NTLM authentication.

Unlike the vulnerability (CVE-2017-0144) exploited by EternalBlue and used in the WannaCry ransomware attacks, which only affected the SMB protocol, this vulnerability has a broader scope and could potentially affect a wider range of Windows systems due to a larger attack surface of services exposed to the public internet (HTTP, RDP, SMB) or on internal networks. This vulnerability does not require user interaction or authentication by a victim on a target system.

? There’s reports emerging that a new zero day exists in Microsoft Exchange, and is being actively exploited in the wild ?

I can confirm significant numbers of Exchange servers have been backdoored - including a honeypot.

Thread to track issue follows:

— Kevin Beaumont (@GossiTheDog) September 29, 2022

Microsoft appear to be aware but have not informed customers.

— Kevin Beaumont (@GossiTheDog) September 29, 2022

Linkek:

• https://nki.gov.hu/it-biztonsag/hirek/figyelem-ms-exchange-zero-day-sebezhetoseg-aktiv-kihasznalas-alatt/
• https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
• https://doublepulsar.com/proxynotshell-the-story-of-the-claimed-zero-day-in-microsoft-exchange-5c63d963a9e9
• https://thehackernews.com/2022/09/warning-new-unpatched-microsoft.html

"Kedves ügyfeleink! Honlapunkon, alkalmazásainkon (Telekom alkalmazás, TVGO, Mobilvásárlás), webmail szolgáltatásunkon, valamint ügyfélszolgálati csatornáinkon (1414, 1400, 1777) átmeneti technikai hiba lépett fel, melyek javítását illetékes munkatársaink már megkezdték. A technikai hiba Telekom TV ügyfeleink szolgáltatását is érinti.

Köszönjük a megértést, a hiba javításáig türelmetek kérjük! Amint a hiba elhárult, ezen a csatornán tájékoztatni fogunk benneteket!"

Zoom’s patch was… ?… incomplete, I managed to bypass it ?

So, please update to 5.11.6. https://t.co/Ok2OwmEHBF

— Csaba Fitzl (@theevilbit) August 18, 2022

Ugyanis a Zoom kétszer adott ki hozzá frissítést, de harmadszor is sikerült - ezúttal Fitzl Csabának - megkerülni a javítást:

A Randorisec részéről Arthur Mongodin egy, a Linux kernel Netfilter alrendszében levő heap buffer overflow sérülékenységet (CVE-2022-34918) elemez ki itt. A sérülékenység sikeres kihasználása a helyi, emelt szintű privilégiumok nélküli támadót root jogokhoz juttathatja.